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ABSTRACT 

The purpose of this paper is to identify and 
describe some of the human factor problems which 
can occur in the cockpit of a modern civilian 
helicopter. After examining specific hardware and 
software problems in the cockpit design of the 
Eurocopter (Aerospatiale) AS332L-1 Super Puma, 
the author proposes several principles that can be 
used to avoid similar human factors problems in tire 
design of future cockpits. These principles relate to 
the use and function of warning lights, the design of 
autopilots in two-pilot aircraft, and the labeling of 
switches and warning lights, specifically with 
respect to abbreviations and translations from 
languages other than English. In the final section 
of the paper, the author describes current trends in 
society which he suggests should be taken into 
consideration when designing future aircraft 
cockpits. 

NOMENCLATURE 

ADF Automatic Direction Finder 

ADI Attitude Deviation Indicator 

CDI Course Direction Indicator 

DECCA Area Navigation System 

DME Distance Measuring Equipment 

EFIS Electronic Flight Info. System 

FFCL Fuel Flow Control Lever 

HSI Heading Situation Indicator 

IFR Instrument Flight Rules 

ILS Instrument Landing System 

LORAN Area Navigation System 

MGB Main Gear Box 

NG Gas Generator Speed 

NR Rotor Speed 

T4 Engine Exhaust Gas Temp. 

VLF /OMEGA Area Navigation System 
VOR VHF Omnidirectional Receiver 


INTRODUCTION 

The Eurocopter (Aerospatiale) AS332L-1 
Super Puma is a twin-engine commercial helicopter, 
primarily designed for passenger transport. It is a 
derivative of the SA 330 Puma which was 
developed initially to meet a French Air Force 
requirement for a medium-sized helicopter able to 
operate day or night in all weather and in all 
climates. Although used very little in the United 
States, the Super Puma is popular in many parts of 
the world and has been particularly successful in 
offshore oil market in the North Sea. The AS332L- 
1 is equipped with Turbomeca Makila 1A1 engines, 
can carry up to 24 passengers, has a maximum gross 
weight of 18,960 pounds, and has a maximum cruise 
speed of 150 knots. 

The author flew and instructed in Super 
Pumas for Helikopter Service A/S of Norway, a 
North Sea offshore operator, and Trump Air of 
New Jersey, a FAR Part 135 operator. The 
information contained in this report comes from 
over five years and 2000 hours of flying experience 
in the Super Puma and from over 600 hours of 
instruction and observation of other experienced 
professional pilots in a six-axis AS332L-1 
Rediffusion simulator owned by Helikopter 
Service. 

It is the author's contention that the 
optimum cockpit design for any aircraft will not be 
found by the manufacturer alone. Line pilots and 
instructors can and should help manufacturers 
decrease the incidence of human factor errors by 
providing enlightened feedback about ergonomic 
problems encountered in the cockpit. 


Presented at the Fifteenth European Rotorcraft 
Forum, Amsterdam, The Netherlands, 1989. 
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THE SHELL MODEL 

The SHELL Model (Fig. 1) is one conceptual 
model of human factors. In the center of the model, 
is the human operator, or LIVEWARE. When 
working with a machine, the operator must contend 
with SOFTWARE, HARDWARE, the 
ENVIRONMENT, and other LIVEWARE. A 
mismatch anywhere in the system causes stress, 
which decreases efficiency and safety. 
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FIGURE 1. The SHELL model of human factors. 


HARDWARE relates to the machine itself and, 
with respect to aircraft, includes such things as 
controls, displays, warning systems, safety 
equipment, seat design, and cabin facilities. 

SOFTWARE, again in relation to aircraft, includes 
operating procedures, format of manuals, checklist 
design, language of information, graphs/tabulation 
design, and symbology. 

ENVIRONMENT includes temperature, noise, 
vibration, humidity, pressure, light, pollution, and 
circadian/biorhythmic cycles. 

LIVEWARE includes personal relations, crew 
coordination, discipline, communications, and 
leadership. 1 

The main concerns of this paper are with 
the hardware and software portions of the SHELL 
model. Although there is room for improvement of 


environmental factors in many aircraft and 
particularly helicopters, problems with these 
factors are generally well-known. Liveware 
factors, i.e. the human- to-human interactions, are 
usually outside the realm of the designer's 
influence, although such things as radio and 
intercom systems, which are also hardware items, 
have obvious effects on communications. Therefore, 
both environmental and liveware concerns are 
outside the scope of this paper. 

HARDWARE FACTORS OF THE AS332L-1 
COCKPIT 

Engine Malfunction Warnings 

"OVSPD" warning switch/light. To protect 
against an engine and rotor overspeed, the fuel 
control on the Aerospatiale AS332L-1 Super Puma 
is designed to shut down the engine automatically 
if the power turbine speed goes too high. Because 
the main conditions that can cause a power turbine 
overspeed (high speed shaft or free-wheeling unit 
failure) happen so quickly, an overspeed warning 
light (Fig. 2) is provided so that the pilots realize 
the engine has shut itself down due to an 
overspeed. This is a good thing to know because 
one should normally not re-start an engine if this 
happens. 



FIGURE 2. "OVSPD” warning switch/light. 

A relevant point is that the "OVSPD” 
light bums steadily when the engine is shut down 
normally, but the light flashes when the overspeed 
mechanism shuts the engine down. 

This creates a human factors problem. Most 
pilots have a built-in aversion (although actually 
it is a conditioned response) to flashing lights in 
the cockpit. Their immediate gut reaction to a 
flashing lighted switch is to press the switch to 
make it stop blinking. A typical example is the 
master caution light in some aircraft. Another 
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example is the RACAL Avionics RNAV 1 DECCA 
system which flashes a warning light that must be 
depressed when there is a problem. There are 
certainly many other good examples. 

How can a flashing light be a problem? 
Consider the following scenario. First, one engine 
fails due to an overspeed. The copilot sees the 
flashing "OVSPD" light, says nothing, and then, 
unconsciously, presses the light to stop it flashing. 
Many companies even specify that the first action 
during any emergency procedure is to extinguish the 
master warning light. 

A few minutes later, the captain, who up to 
this point has been concentrating on flying the 
aircraft, considers trying a restart because he didn't 
see the overspeed warning light flashing and the 
light is now steady. The copilot, who cancelled the 
only indication that would tell them they had an 
engine overspeed, readily agrees to a restart 
because he cancelled the light without consciously 
thinking about it. The engine starts normally, 
because the broken engine-to-MGB shaft has no 
effect during the starting sequence, but as the pilots 
increase power, the unburdened power turbine and 
its broken shaft spin faster and faster until 
something else breaks. Although this has never 
happened in flight, there is one instance of a Super 
Puma engine being re-started by a mechanic on the 
ground after the engine had shut down due to an 
overspeed. The aircraft caught fire and was 

destroyed.^ 

Three lessons can be learned from this 
example. First, flashing warni ng lights should 
only be used for the most seriou s of malfunctions. 
Too many flashing lights in a cockpit defeats their 
purpose, which is to catch the pilots' attention and 
alert them to a particular problem. 

Second, it should only be possible to 
extinguish a flashing warning light bv taking the 
proper corrective action and removi ng the hazard. 
For example, a flashing fire warning light should 
only go out when the fire itself has been 
extinguished. 

Third, extreme care m ust be used when 
desig nin g a switch to function as both a switch and 
a warning li ght. If the light in a switch does more 


than simply indicate whether an item is off or on, 
die function of die switch must be easily understood 
at all times and under all conditions. One should 
not assume that a task people can do under normal 
conditions will still be error-free when a panic is 


"POWER" light. Another engine light that causes 
problems is the "POWER" light. The "POWER" 
light is under the direction of the power calculation 
system which is designed to help the pilots 
determine which engine is malfunctioning under 
various conditions. Very basically, the power 
calculation system examines the Ng (gas generator 
rpm) readings from both engines and the Nr (rotor 
rpm) to determine which engine has malfunctioned 
and why; then it illuminates the "POWER 1" or 
"POWER 2" light as appropriate. 

This is particularly good information to 
provide the pilot when the automatic fuel control 
of one engine fails and that engine, although still 
operating, must be controlled manually. Because 
the other engine automatically varies its power 
output in order to maintain Nr within limits, it can 
be difficult to determine which engine is 
malfunctioning. 

The problem with the "POWER" lights is 
that they don’t illuminate until Nr varies 
approximately 6-7% above or below the usual in- 
flight setting of 100-101%. Although these Nr 
values are neither dangerously high nor low, they 
are well outside the "usual" Nr values. 

Notice die use of the word "usual" and not 
"normal." After one hundred or so hours in any 
aircraft, most pilots know what the "usual" values 
are for pressures, temperatures, rpm, etc. As a 
result, they become suspicious when they see 
"unusual" values, even if these values are within 
the specified "normal" limits. When a helicopter 
pilot observes an "unusually" high or low Nr, his 
first reaction is to adjust collective pitch to bring 
die Nr back to its "usual" normal value. 

What happens when an automatic fuel 
control malfunctions and causes the Nr to vary is 
that the pilot instinctively adjusts the collective 
pitch to bring the Nr back to where it belongs. This 
defeats the intention of the power calculator 
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system because it cannot illuminate a "POWER" 
light unless the Nr is above 107% or below 94%. 
The pilot is left to figure out which engine is 
malfunctioning by interpreting the Ng and T4 
indications; or he can choose to raise or lower the 
collective until the Nr changes enough to cause the 
power calculator to illuminate a "POWER" light, 
an action which many pilots are reluctant to do. 

Autopilot System 

General. Any pilot who has ever worked with an 
advanced autopilot knows that the most frequent 
mistakes made by pilots, even after they know how 
the system operates, are: 

1) pushing the wrong buttons at the right 

time, 

2) pushing the right buttons at the wrong 

time, 

3) pushing the right buttons in the wrong 
sequence, 

4) thinking that an autopilot function is off 
when it is on, and 

5) thinking that an autopilot function is on 
when it is off. 

A primary cause of these errors is the 
manner by which the autopilot functions are 
displayed. Usually, the annunciator lights are 
shown on one central autopilot panel, which is 
often on the center cockpit console (easy to reach, 
but out of sight). Sometimes the annunciators are 
duplicated elsewhere in the cockpit, on the panels 
in front of the pilots or even on the flight 
instruments themselves. For example, airspeed 
hold may be displayed on the airspeed indicator, 
altitude hold on the barometric or radar altimeter, 
localizer and glide slope hold on the HSI 
(Horizontal Situation Indicator) or artificial 
horizon (ADI). 

Of the three, methods, indicating autopilot 
functions on the flight instruments is the best 
because this is the method the autopilot 
annunciators will be seen most often by the piloL 
The simple reason is that the flight instruments are 
an integral part of every experienced pilot's cockpit 
scan. The autopilot annunciator panel on the center 
console is not a frequent part of most pilots' 
instrument cross-check.^ 


AS332L-1 autopilot system. The Helikopter 
Service AS332L-1 Super Pumas are equipped with 
SFIM 155 duplex autopilot systems, SFIM CDV 85 
four-axis couplers, Collins ADI-77 Attitude 
Direction Indicators, and Astronautics 133640 
Horizontal Situation Indicators.^ 

Mixing boxes from different manufacturers 
may not always be desirable, but due to economic 
reasons (mixing may be less expensive), operational 
considerations (one system may not provide all 
things to all operators), and marketing aspects 
(compatibility of systems means greater potential 
sales), mixing systems is not going to go away. As a 
consequence, designers of the various components 
hay-gJQ pay, even more, attention to. hunrnnJacloi 
problems and, equally important , there must be 
someone in the loop who is able to examine the 
resulting system in its entirety . 

With respect to the autopilots in 
Helikopter Service's Super Pumas, when they work 
as designed, the autopilots are truly impressive. If 
there is a malfunction, there are, for the most part, 
sufficient back-ups and warnings for the pilot. In 
other words, the autopilot hardware, per se, is 
generally very good. 

However, of all the systems in the Super 
Puma, it is universally agreed in Helikopter 
Service that the autopilot is the most difficult for 
pilots to master. Many of the difficulties with the 
autopilot stem from human factor problems in the 
design of the system. 

Single- or dual-pilot system? The most basic 
problem with the system is that it can not be fully 
operated from the left seat. Certain functions, for 
example coupled ILS and coupled vertical speed, 
can only be controlled by the pilot in the right seat. 
The system favors the captain’s side of the cockpit 
to the detriment of the copilot s side. 

The reason was Aerospatiale's original 
intention to obtain single-pilot IFR certification for 
the Super Puma. This has not been obtained and 
may never be, but the result is an autopilot system 
that makes it difficult or impossible to set up, 
among other things, a coupled ILS approach from 
the left seat. 
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Why is this lack of full dual-pilot 
capability not good? Consider this scenario: The 
captain becomes incapacitated, the weather at the 
airport is at minima, and the copilot is young and 
inexperienced. He needs all the help he can get, 
but because he can't reach the necessary switches on 
the right side of the cockpit, he has to fly the ILS 
uncoupled. 

A good general principle to use when 
designing autopilot and coupler systems is to make 
all autopilot functio ns fully controllable from both 
seats in the cockpit. There should also be one 
switch, easily accessible to both pilots, that passes 
autopilot authority from left to right and back 
again. And there must be a well-defined 
annunciator prominently located on the front panel 
(the best place would be right on the artificial 
horizon) telling the pilots who has the authority. 

With respect to single-pilot IFR, the 
following policy statement from the International 
Federation of Air Line Pilot Associations (IFALPA) 
is appropriate: 

"Although IFALPA recognizes that presently 
single-pilot commercial operations are in 
widespread use, this type of operation is not 
acceptable during international public 
transport flights, including all off-shore 
flights, because of the reduced level of safety." 

Single-pilot IFR capability is great, but it should 
be available to both captain and copilot alike. 

Heading select switch. The Helikopter Service 
machines have a switch which is used to transfer 
autopilot authority between the pilot and copilot, 
however it only controls the heading select 
function of the system (Fig. 3). Both pilots have a 
selected heading index, or heading "bug," on their 
horizontal situation indicator (HSI) which is used 
to set a desired heading the autopilot coupler 
should maintain. The heading select switch tells 
die autopilot which heading index to follow. 

hcaoing Select 

O 

COPILOT PILOT 


FIGURE 3. Heading select switch. 


The idea is simple enough and easy to 
understand, but the switch and its associated 
annunciator lights indicating which pilot has 
heading authority are located on the pedestal 
console between the pilots, far away from the HSIs 
and other primary flight instruments. The error, 
which happens frequently, is that one pilot sets his 
heading index to the desired heading and, 
forgetting to check the heading select switch, 
engages die coupler heading hold. If the switch is 
still set to the other pilot and his heading index is 
set at another heading, the autopilot will 
obviously turn the helicopter to an undesired 
heading. 

This problem could have been avoided by 
putting the annunciator lights for the heading 
select switch on the heading indices of the HSIs. 
When the pilot has heading control, his index is 
illuminated (or some other way highlighted); 
when the copilot has heading control, his heading 
index is highlighted. . 

Localizer and glide slope capture modes. The 
problem with these modes is deceptively small, yet 
potentially extremely dangerous. The "fix” is 
probably relatively simple, given the complexities 
of the rest of the autopilot system. 

An Instrument Landing System (ILS) 
provides precision guidance to a runway while 
providing very specific obstruction clearances 
throughout the approach. By regulation and 
common sense, an aircraft is not allowed to descend 
on the glide path until it is established on the 
localizer course. 

With the SFIM CDV 85 four-axis coupler, 
it is possible to arm both the localizer and glide 
slope modes before being established on either one. 
This makes sense because the pilots can set up the 
autopilot before they reach die localizer. What 
doesn't make sense is that it is possible to capture 
the glide slope before the localizer is captured, 
and, in fact, even with the localizer mode un- 
armed. As a result, the aircraft will descend on the 
glide slope beam while outside the limits of the 
localizer, which means that the aircraft could be 
descending below the minimum altitudes 
designated for that part of the approach. 
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Coupler and flight director annunciation. Human 
factor specialists have often observed that people 
adapt well to design deficiencies in their working 
environment One way Super Puma pilots have 
adapted to the poor annunciation of the coupler 
functions is to use the flight director command bars 
(Fig. 4, #2 & 6) on the ADI as an indication to them 
that the coupler is on. With the command bars 
right on the instrument they look at most often, the 
presence of the bars is not hard to overlook. The 
pilots simply make it a personal habit to always 
engage the flight director whenever they engage 
die coupler. 



FIGURE 4. Attitude Deviation Indicator 


This practice does, however, have one big 
disadvantage. If the autopilot disengages, due to a 
malfunction, on purpose, or inadvertently (and it is 
disengaged inadvertently from time to time), the 
coupler drops out, but not the flight director. This 
makes sense because it is useful to have flight 
direction when the autopilot is out. The problem 
occurs when the autopilot is switched back on. 

It is not difficult to know when the 
autopilot disengages: one feels the difference in die 
cyclic at once. The non-flying pilot usually notices 
the change in the stability of the flight, as well, 
and if he is alert, he reaches down and re-engages 
the autopilot within seconds. Both pilots breathe 
a sigh of relief. 

Unfortunately, their problems are not over. 
For although the autopilot is back on and the 


flight director command bars are still in view on 
the ADIs, the coupler is not engaged. The only 
indication that tells the pilots the green coupler 
function lights are sending signals to the flight 
director only and not to the autopilot, is a small, 
dimly-lit "F/D" light tucked away above the 
ADIs. 

It usually takes some time and perhaps 
large heading or altitude deviations before the 
pilots discover that the autopilot coupler functions 
are not flying the helicopter for them. If this 
happens during a critical phase of flight, such as 
during an instrument approach to an oil rig at night, 
die consequences could be tragic. 

"CPL" warning light Whenever a coupler function 
fails or is turned off, the "CPL” light on the master 
annunciator panel and the master "WARN" lights 
illuminate. Pilots like to have warnings when 
something fails, but to receive a warning every time 
something is purposely switched off is counter- 
productive. 

The human factor reason is so obvious that 
it is difficult to understand how it was overlooked: 
If a warning light comes on numerous times during 
every, flighteventually it will be ignored . 

The first time a pilot new to the Super 
Puma switches off a coupler hold function he 
immediately notices the "CPL" and "WARN" 
lights illuminating, and, being new to die machine, 
he logically assumes something has failed. 
However, by his third or fourth flight, he is 
already ignoring the "CPL" light or canceling it 
without thought. 

The story about the boy who cried "Wolf!" 
is a good lesson in human nature which was 
apparently forgotten when the SFIM designers 
were working on this part of the CDV 85 four-axis 
coupler. 

Navigation Equipment 

NAV-HSI switching panel. Another very 
confusing part of the Super Puma is the navigation 
switching panel (FIG. 5). Basically, each pilot 
has two pointers on the HSI, and he has switches 
by which he can choose which navigation radios 
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he wants to monitor. There is also a switch that 
controls the Course Direction Indicator (CDI) 
which accepts signals from VOR 1 or VOR 2. 
However, there is an inflexibility in the system in 
that the autopilot will accept coupled ILS signals 
only from VOR 2 and only when the right-seat 
pilot has selected VOR 2 on his CDI and only when 
the heading select switch is set to "PILOT." This 
automatically, restricts the pilots' choices if they 
want to fly a coupled ILS. 



FIGURE 5. NAV-HSI switching panel 

The number 1 (green) pointer on both pilots' 
HSIs takes signals from either VOR 1 or the ADF 
(or ADF 1 if two are installed). The number 2 
(orange) pointer takes signals from VOR 2 and the 
ADF (or ADF 2 if two are installed). 

The confusion occurs because BOTH pointers 
can indicate either VORs or ADFs and it is common 
to use both a VOR and an ADF during many VOR 
and ILS approaches. What can easily happen is 
that the copilot has the ADF on pointer 1 and the 
VOR on pointer 2 and the pilot has the opposite 
indications. 

A better system, given the limitations of 
only two pointers, would be to designate one pointer 
as the VOR pointer and the other pointer as the 
ADF pointer, with a switch to reverse these 
functions in case of a pointer failure. That way 
both pilots would always know that they have 
VOR information on the green pointer, for example, 
and ADF information on the orange pointer. To 
remove the question of which VOR or ADF is being 
monitored, the pointers themselves could display a 
"l” or "2," indicating, respectively, VOR 1 or VOR 
2 on the VOR pointer and ADF 1 or ADF 2 on the 
ADF pointer. The navigation pointers incorporated 
in many EFIS installations the author has seen are 
labelled in this manner. 


One could monitor two VORs on the same 
HSI by switching the CDI to one VOR and the VOR 
pointer to the other. It would not be possible to 
monitor two ADFs simultaneously on one HSI, but 
this is a relatively infrequent requirement. (The 
Helikopter Service Super Pumas are only equipped 
with one ADF anyway.) If there is a requirement 
to monitor two ADFs, the pilot could monitor one 
and the copilot the other, or, as an alternative, 
either pilot could switch between ADF 1 and ADF 2 
every few minutes to check the relative bearings to 
the NDB stations. 

DME selection. It is possible to monitor one of six 
different DME stations depending on how the 
switches are set. However, the only indication of 
which VOR frequency is giving the DME reading is 
by the position of the switch and a light on the 
radio itself. The light indicates that the DME is 
coming from that box (number one or two), but it 
could be from one of three possible frequencies, one 
of which may not be displayed, depending on the 
position of the HOLD switch. 

This can and does create so much confusion 
that Helikopter Service instructors recommend 
setting toe DME function switch to VOR 2 (because 
this is the only VOR that can be used to fly a 
coupled ILS approach ) and just leaving it there all 
the time, except in those rare cases when DME 
information from a second VOR is required. The 
problem is that there are just too many choices — 
too many frequencies from which one can receive 
DME information. In the heat of an approach or a 
missed approach, it's easy to forget which DME one 
is monitoring. 

Radio frequency selection. This is a generic problem 
to many aircraft, not just the Super Puma. Many 
operators do not have 100% standardized fleets. In 
fact, there are probably very few operators that 
have toe same radios in all their aircraft. This is 
obviously a matter of economics that pilots just 
have to live with. 

With most radios, toe frequency selected 
increases when one rotates toe knobs clockwise, but 
on a few toe frequencies increase when toe knobs 
are turned counter-clockwise. Some radios allow 
one to rotate the knob past the highest useable 
frequency and continue turning to the lowest 
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frequency on the scale, and vice verse. Others stop 
at the highest and lowest frequencies, making it 
necessary to turn the knob back the other way. Most 
two-tiered knobs (like wedding cakes) work so that 
the lower, bigger knob adjusts the numbers in the 
left window (therefore the higher numbers) and 
the higher, smaller knob adjusts the numbers in the 
right window (therefore the lower numbers); other 
radios work just the opposite. 

It goes without saying that pilots are going 
to have trouble tuning frequencies when they have 
to use different radio sets. This may seem like a 
relatively small thing, and most of the time it is, 
but it can be a time-waster. In the worst case a pilot 
may accidently set the wrong frequency, not have 
time to check the windows, and miss a critical 
radio call. Standardizing how frequencies are 
dialed in will eliminate one area in the cockpit 
that is prone to mistakes . 

Landing Lights 

When the search light switch in the Super 
Puma is pushed down, the search light moves up. 
When the switch is pushed up, the search light 
moves down. 

This is exactly opposite from the way the 
moveable search light in the S-61 and Bell 212 
work and since all Helikopter Service pilots flew 
one or both of these helicopters before transitioning 
to the Super Puma, it’s no wonder that this causes 
difficulty. 

Most of the time landing lights are not 
needed until short final when they need to be 
positioned quickly and accurately. When the light 
moves in the opposite direction from what is 
expected, it’s not only irritating, but potentially 
dangerous as well. 

As a rule, moveable landing and search 
lights should move up__wherLJhe switch is. pushed 
up and move down when the switch is pushed down . 

Intercom Switching 

The pilot's and co-pilot's intercom switches 
are two-position switches, "NORM" and "EMER". 
In the normal position, the voice-actuated system 


works, which is an extremely good system to use. 
The emergency position is there in case the normal 
power supply to the system is lost. When in 
"EMER," the pilots have to key the microphone 
switches on the cyclics or the intercom control panel 
in order to talk to each other. 

The intercom system would be better if the 
need to switch to "EMER" in case of a normal supply 
failure were eliminated. In other words, once the 
pilots discover that the voice-actuated system no 
longer works, all they have to do is use the cyclic or 
panel microphone switches. 

Trouble-shooting an electrical fire is one 
emergency when the emergency intercom system is 
needed. Various electrical suppliers must be 
switched off, including the normal power supply to 
the intercom and the autopilot. One pilot must 
therefore concentrate exclusively on flying while 
the other pilot is trying to isolate the fire. This is 
no time for communication difficulties. Requiring 
both pilots to switch to "EMER" just adds an 
additional burden and stress factor to the 
emergency. 

SOFTWARE FACTORS OF THE AS332L-1 
COCKPIT 

General 

As noted before, software factors include 
many items, all of them concerned with 
information. Often, good, well-designed operating 
procedures and checklists can make up for design 
faults in the aircraft. For example, with reference 
to the flashing "OVSPD" light problem, 
Helikopter Service has a prominent note in the 
company Emergency Checklist under "Engine 
Malfunctions," stating that a failed engine should 
not be re-started if the "OVSPD" light is flashing. 

It is not the intention of this paper to try to 
examine the flight manual, operating procedures, 
and all other information sources about the Super 
Puma, but rather to limit the discussion to the 
information presented to the pilot in the cockpit. In 
the author's opinion, the "AS332L-1 Super Puma 
Instruction Manual" is is very well written. 
However, there are two main problems with the 
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manual, which also apply to the cockpit 
indications. The first is the occasional 
inconsistency among terms and the second is 
occasional poor translations from French to English, 
including abbreviations. These two problems are 
probably related in many instances.** 

An example of the first is the use of both 
"generator" and "alternator" to describe the same 
thing in the electrical system. Examples of the 
second type of problems, translations and 
abbreviations, are discussed below. 

"MGB COOL" Warning Light 

The Super Puma main gear box has two 
lubrication pumps, a normal one and an emergency 
one. Both pumps are essentially the same and both 
run continuously. The main differences are (1) the 
main pump delivers a slightly higher pressure, (2) 
the input to the emergency pump is positioned 
below the input to main pump, and (3) the 
emergency pump system bypasses the transmission 
oil cooler. 


If the main pump stops delivering oil, 
either due to a leak in the system or failure of the 
pump itself, the emergency pump will continue to 
supply oil to the main gear box. The emergency 
pump bypasses the transmission oil cooler because a 
leak in the system will most likely be in the 
plumbing to the oil cooler. The emergency pump 
lubricates everything in the main gear box, but the 
oil is no longer cooled. As a consequence, one can 
expect a gradual rise in transmission oil 
temperature with a failure of the main pump or a 
leak. 

It's obviously important to warn the pilot 
that this has happened and the "MGB COOL" 
light (Fig. 6, #6) serves this function. It is triggered 
by a pressure switch which senses the drop in 
pressure in the line downstream of die oil cooler. 

The theory is very good and the light 
works in practice, but the language on the light 
creates confusion. "MGB COOL" does not mean that 
the MGB is now cool or will become cool. Quite to 
the contrary, the oil will now become hotter . Nor 



FIGURE 6. Main gear box lubrication system . 
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does the light mean that the MGB cooler has 
failed. If the cooler fails, due to a broken drive 
shaft or shattered fan blades (both of which have 
happened a number of times), the "MGB COOL” 
light does not illuminate; what one sees is a rise in 
MGB temperature and, eventually, a "MGB TEMP" 
warning light. "MGB COOL" means that the MGB 
cooler has been bypassed . This is not, however, the 
most important thing the pilot needs to know at 
this point, even if he does remember what the light 
signifies. 

The important thing is that the main pump 
is no longer delivering oil to the system, either 
because of a failure or a leakage. Therefore, it 
would seem to make more sense for the light to be 
labelled so that it better conveys this information, 
for example, "MGB PUMP.” The point is: The 
wording u sed on warning lights must be carefully 
chosen so that the most critical factor of a given 
malfunction is immediately comprehended . 

Hydraulic Panel 

The labelling on the hydraulic panel is 
particularly confusing, even to pilots who have 
flown the Super Puma for many years (Fig. 7 A & 
7B). The problem is that the abbreviations are not 
consistent and this was a result of translating 
abbreviations from French to English. 



FIGURE 7 A. Hydraulic panel with French 

abbreviations. 

The culprits on the English switches are 
the letters "P" and "H." On some of the switches, 
the letter "P" stands for "pump" and on other 
switches it stands for "pressure." On every switch 
"P” appears, it could logically stand for either 
"pump” or "pressure." 


On some of the switches, the letter "H" 
stands for "hand" and on others it stands for 
"hydraulic." On many of the switches, "H" could 
stand for either "hand” or "hydraulic." On one 
switch, "H" stands for both "hand" and 
"hydraulic." 

The correct meanings are as follows: 

LH.P - LEFT HAND PRESSURE (low) 

LH.LEV = LEFT HAND LEVEL (low) 

LH.H.MP = LEFT HAND HYDRAULIC 
MAIN PUMP (failure) 

AP.H.P = AUTOPILOT HYDRAULIC 
PRESSURE (low) 

AUX.HP = AUXILIARY HYDRAULIC 
PRESSURE (low) 

AUX.P = AUXILIARY PUMP (failure) 

AUX.P = AUXILIARY PUMP (on/off switch) 
RH.P = RIGHT HAND PRESSURE (low) 
RH.LEV = RIGHT HAND LEVEL (low) 



FIGURE 7B. Hydraulic panel with English 

abbreviations. 

It's easy to understand how this creates 
confusion. Anything that does this, particularly 
during an emergency, is going to increase the stress 
level and the chances for mistakes. The lesson is 

obvious; Make all ^abbreviations readily 

understan dable and consistent . 
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"THROT" Light 

This light indicates that one or both of the 
fuel flow control levers (FFCL) is not in the 
’’FLIGHT' position, where they normally should be 
if they are working normally. It's a useful light 
with an engine failure and subsequent shut-down 
because it is the only warning light that remains 
illuminated after the FFCL has been set in the 
shut-off position. (The "DIFF NG” and "PRESS 1" 
or "PRESS 2” lights extinguish when the FFCL is in 
the shut-off position.) 

But why is it called the "THROT' light, 
and not, for example, the "FFCL" light? The term 
"throttle" is not used anywhere in the Instruction 
Manual or the Flight Manual. The proper term is 
"Fuel Flow Control Lever.” The use of the word 
"throttle" and its abbreviation "THROT" is, 
perhaps, either a carry-over from the days when 
most helicopters had reciprocating engines and, 
therefore, throttles (admittedly, some still do) or 
perhaps it's just another translation problem from 
French to English. 

The point is: Consistency . Items should 
always be referred to by the same correct name, 
both in the flight manual and in the cockpit. 

Autopilot Panel 

The hardware aspects of the autopilot 
were discussed previously. The software aspects of 
the panel are actually quite good, with only a few 
minor exceptions. 

To test the basic autopilot system, one 
moves the test switch from "TEST" to "RUN," 
meaning, apparently, that one is "running the test." 


On the other hand, to test the collective 
part of the autopilot (the fourth-axis), one moves 
the test switch from "NORMAL" to "TEST." 

Again, it’s a small point, but one that is 
easily corrected. 

"RB. SAFE" and "ROT.BR" Lights 

The Super Puma has a two-lever rotor 


brake system with a rotor brake safe lever and a 
rotor brake lever. It is possible to move the rotor 
brake lever to the braking position in flight (which 
obviously should not be done), but it will do nothing 
more than cause the "ROT.BR" light to illuminate 
(Fig. 8). Hydraulic pressure to the rotor brake is 
obtained only when both levers are pushed 
forward, a sensible system which just about 
guarantees that the rotor brake won't be engaged 
inadvertently at the wrong time. 



FIGURE 8. "KB. SAFE " AND " ROT.BR " lights 

"RB. SAFE" means that the rotor brake 
safety lever is in the forward position, not, as one 
may be lead to suspect, that the rotor brake is safe. 
Actually, one could argue that with the safety 
lever in the forward position, the rotor brake 
system is unsafe because, now, if the rotor brake 
lever is moved forward, braking pressure will be 
applied to the rotor system. In effect, moving the 
rotor brake safety lever forward arms the rotor 
brake system. 

So why not label the "RB. SAFE" light "RB 
ARM?" One could also change the "ROT.BR" 
light to "RB ON” to make the abbreviation of 
"rotor brake" consistent. 

Heater Distributor Valve Control 

The heater has a three-position distributor 
valve control lever so that the pilots can choose 
where they want the heat directed. In the forward 
position, the heat is divided between the cockpit 
and the autopilot; in the middle position, heat goes 
to the cockpit, die autopilot, and the cabin; in the 
aft position, all heat distribution to the aircraft is 
cut off. The problem with the heater lies in the 
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fact that the distributor valve control lever has 
been poorly labelled. 

The forward position is labelled 
"COCKPIT POSTE PILOTE." This looks like a 
blending of English and French - it probably means 
the cockpit will be heated. But it says nothing 
about the autopilot which is also heated. 

The middle position is labelled "O." A 
person who knows a little French might conclude 
that "O" is an abbreviation for "ouvert" which 
means "open." But what is being heated with the 
switch open? There’s no way to determine this from 
the labelling of the switch. On the other hand, a 
person who knows no French might think the "O" 
(oh) is a "0 M (zero) and that it means the heater is 
off or closed. 

The aft position is labelled vertically "F 
C" Again, a French speaker might assume the "F 
stands for "ferm6” which means "closed" and the 
"C" might be an English abbreviation for "closed." 
Then again, both letters could be either French 
abbreviations or English abbreviations. It's very 
hard to tell. 

This may seem like a small thing again; 
after all, it’s only the heater switch. But it is also 
confusing, annoying, and totally unnecessary. With 
only a bit more thought and effort, the lever could 
have been labelled so that the function of the three 
positions were obvious. 

SPURIOUS WARNINGS 

As was mentioned before concerning the 
"CPL" light illuminating every time a coupler 
function is switched off, continuous unnecessary 
warnings eventually are ignored. Complacency 
with respect to the warning is the result. In some 
aircraft, pilots have gone so far as to pull circuit 
breakers for certain specific warning lights because 
they were so prone to false warnings. MGB chip 
warning lights are notorious examples. 

Sophisticated electronic systems seem to be 
all too prone to spurious warnings. The numerous 


landing gear position switches in the Super Puma 
are particularly sensitive, and if it weren’t for the 
aircraft’s emergency electrical and hydraulic 
extension possibilities, there would be a lot of gear- 
up landings at Helikopter Service. These switches 
are not, however, just a problem for the landing 
gear, but also for all the auxiliary equipment 
which receive "GROUND" or "FLIGHT" signals 
from these same switches. 

For example, a common problem with the 
Super Puma is for the area navigation system (be it 
VLF /OMEGA, DECCA, LORAN, or whatever) to 
"freeze up" in flight. The solution is to re-cycle the 
landing gear. The cause is the loss of the "FLIGHT' 
signal to the area nav system because one of the 
landing gear has moved out of position far enough 
to open a switch which should have been closed. 

Another related problem concerns the 
autopilot. Once the author found it impossible to 
run the autopilot test, even though the switch was 
moved from "TEST" to "RUN" several times. All 
the functions worked, but the test just wouldn’t run. 
A mechanic was notified and he immediately 
realized the problem was a position switch in the 
nose gear. He grabbed a tow bar, jiggled the nose 
wheel, and the autopilot test worked as designed. 

Incorrect fire warning system tests during 
start-up are another headache. Mechanics have 
changed system control cards, wiring harnesses, and 
fire detectors, but usually the problem is simply 
moisture. Most of the time the system will test 
properly after the engines are started and 
everything is allowed to warm up and dry out. 

The point is that pilots quickly loose faith 
in a warning system if it continually gives false 
warnings. When a warning system cries "Wolf!" 
all the time when there is no wolf, the one time 
there really is a wolf at the door, it may be 
ignored. The increased use o f electronics and 
computers in helicopters promises numerous 
advantages for the pilots, but the systems must be 
constructed so that they are^ not adversely affected 
by the environment. 
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FUTURE CONSIDERATIONS 

"New technologies incorporating multiple 
redundancy and fail-safe concepts are becoming so 
reliable that, in future years, the proportion of 
human factor accidents may reach 100 percent 
simply because the total, irrecoverable failure of 
machine components of the man-aircraft system 
will be eliminated." 

Dr. Robert B. Lee 

Australian Bureau of Air Safety 

Investigation' 7 

"The Space Invader-playing kids of today will be 
die fighter and bomber pilots of tomorrow." 

Ronald Reagan 

40th President of the United States 

Even though former President Reagan 
didn't mention helicopter pilots in the above quote, 
they certainly must be included. What is Just as 
certain is that his prediction is already coming 
true. 

How will this effect human factor problems 
in the cockpit? 

Not more than ten or fifteen years ago, the 
space and aircraft industries were the epitome of 
high-tech. In many ways, they still are, but since 
the advent of inexpensive micro-chips, "smart" 
machines are now commonplace in most homes. 
Today, the gap between sophisticated aircraft and 
sophisticated household machines has narrowed. 
Entire houses can now be controlled by a central 
computer. In late 1988, the Electronic Industries 
Association/ Consumer Electronics Group announced 
a new wiring standard called the Consumer 
Electronics Bus which will enable microprocessor- 
equipped appliances built by one company to 
communicate with those built by another.® 

This means that more and more people will 
use sophisticated electronic and computer- 
controlled devices on a daily basis. Today, many 
children learn to operate machines even before 
they can read. 9 At age four, the author's youngest 
son knew how to operate the remote controls of a 
video cassette recorder and television, find and 
play games on a Macintosh computer, use various 


cassette players, and heat food in a microwave 
oven. Operating machines is second nature to him. 

Aircraft designers will have a new human 
factor element to consider. Instead of the 
automobile, electronic, and other industries 
mimicking the designs of equipment found in 
aircraft, the aircraft manufacturers may find 
themselves copying panel designs from these 
industries in order to avoid human factor problems 
in the cockpit. This is not to say that aircraft will 
loose their place on the cutting edge of technology, 
but that aircraft designers will have to be more 
aware of the designs of equipment made by other 
industries. 

For example, affordable, hand-held GPS 
systems are now available for less than $1000 from 
a number of manufacturers. It won’t be long before a 
dashboard-mounted GPS becomes a common option 
in automobiles and trucks. If the GPS receivers 
pilots find in their aircraft are very dissimilar 
from these car systems and hand-helds, human 
factor errors will occur. 

In the past, pilots had to contend with 
transfer of learning problems between their 
airplanes and their automobiles.^ These problems 
will seem minor to the pilots of future generations 
who will have to contend with transfer of learning 
problems between their aircraft and their cars, 
their computers, their home entertainment systems, 
and numerous other gadgets, appliances, and 
machines, some of which have yet to be invented. 

There will be international "standards" 
developed and accepted, sometimes by agreements 
and official decrees, but perhaps more often by the 
company that is able to sell the most of a particular 
product first. If a similar machine does not fit the 
accepted "norm" or the standard that people have 
become accustomed to, problems will arise. 

A human factors problem occurred when 
Helikopter Service installed a new security system 
in the main office and hanger. Like the old system, 
the new one required the use of magnetic-strip 
identity cards. The old system required one to 
insert the card in the controller and punch in a four- 
digit code before the door would open. The new 
system required that the code be punched in first. 
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then the card inserted. If the card was inserted 
first and then the code punched in, as with the old 
system, a red light blinked indicating something 
was wrong. 

On the first day, hardly anyone could get 
into the building. Even though instructions had 
been distributed beforehand, few bothered to read 
them, assuming wrongly that the new system 
worked die same way as the old one. Most people 
thought there was something wrong with their 
card or their code. The problem was the system 
itself; the fault was that of the engineer who had 
not realized that a "standard" for card-and-code 
door opening systems had already been established 
at the company. 

There may have to be a radical change in 
the way aircraft are designed. In the past, the 
machine was foremost. The goal was to make the 
machine work and if a switch or lever was in an 
awkward position for the pilot, then he just had to 
adapt to it. Fortunately, this attitude has changed 
a great deal since World War II and aircraft 
designers spend much more attention to ergonomic 
factors inside the cockpit. 

In the future, however., designers will, also 
have to look outside the cockpit at the numerous 
other sophisticated machines that are becoming^or 
are already commonplace, when considering human 
factors problems. 

Everything in the cockpit will have to be 
considered in this light. From the simplest 
mechanical things, such as the way the seats are 
adjusted, to the most sophisticated computer- 
driven systems. Designers will have to stay up-to- 
date with currently accepted standards in the 
"outside world." Are computer pull-down menus 
and "windows" so widespread that they should be 
considered standards to be used in the cockpit? 
Should the "QWERTY" keyboard found on 
typewriters or the keypad used on touch-tone 
telephones be the standard for aircraft navigation 
and computer systems? Should the clock be digital 
or analog, or both? Should the artificial feel in a 
fly-by-wire control stick have the same "feel" as a 
Nintendo joystick? These are the kinds of questions 
that must be constantly and continually asked. 


IaJ iglg answe r q ue st ions l i ke these, 

manufacturers must establish, promote, and use .an 
effecti ve fe edback s y stem so t hat i d eas and 
su ggestions- from line pilots, in the field can he 
obtained on a regular basis. 

Every successful company believes it is "the 
man on the shop floor" who best knows how to do 
his job and who has the most useful suggestions 
about how to do it better. Good companies solicit 
information from every level. 

In the author's experience, aviation 
companies are often very conservative and many 
even have military-like organizations. 
Information in military hierarchies goes up and 
down the chain of command, although it usually 
flows down a lot easier than it goes up. If the chief 
pilot or chief of maintenance does not agree with a 
line pilot's or mechanic's suggestion, the idea stops 
there and never gets to the manufacturer where it 
might have been accepted. The only exception is in 
the case of an accident. Then people are listened to. 

A reporting system connecting line pilots 
directly to manufacturers would be an excellent way 
to get feedback about present and future cockpits. ^ 

CONCLUSIONS 

The author readily concedes the subjective 
nature of this paper. However, given the fact that 
the very nature of the applied technology of human 
factors presupposes a degree of subjectivity, the 
author hopes his departure from the scientific 
method will not cause his conclusions to be 
summarily disregarded. In lieu of a feedback 
system described above, a forum such as this is one 
of the few ways a line pilot can make his 
observations and opinions known to people who can 
make a difference. 

1. Flashing warning lights should only be 
used for the most serious of malfunctions; taking the 
proper corrective action and removing the hazard, 
should be the only possible way to extinguish a 
flashing warning light. 
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2. Extreme care must be used when designing a 
switch to function as both a switch and a warning 
light. One should not assume that a task people 
can do under normal conditions will still be error- 
free during an emergency. 

3. Autopilot functions should be annunciated 
on the flight instrument relevant to each particular 
function. 

4. All autopilot functions should be fully 
controllable from each seat. Single-pilot IFR 
capability is great, but it should be available to 
both captain and copilot alike. 

5. It should not be possible for the autopilot to 
capture the glide slope portion of an instrument 
landing system until the localizer is captured. 

6. Warning lights that illuminate every time 
a minor item, such as an autopilot coupler function, 
is switched off have a tendency to be ignored by 
pilots after a few hours of experience in the 
aircraft. 

7. All radio frequency selectors should rotate 
the same direction: clockwise to increase frequency; 
counter-clockwise to decrease. 

8. Moveable landing or search lights should 
move up when the switch is moved up and move 
down when the switch is moved down. 

9. The language used on warning lights and 
switches should be consistent with the wording 
used in the flight manual, checklists, and other 
related material; the wording must be carefully 
chosen so that the most critical factor of a given 
malfunction is immediately comprehended; 
abbreviations should be consistent, logical, and 
easily interpreted; translations to other languages 
must be very carefully checked for correct meanings. 

10. Electronic and computer-based systems must 
be constructed so they are not adversely affected by 
the environment. 

11. Cockpit designers must look outside the 
cockpit, at the numerous other sophisticated 


machines that are becoming or are already 
commonplace, when considering human factors 
problems that may occur in the cockpit. 

12. Manufacturers should establish, promote, 
and use an effective feedback system so that ideas 
and suggestions from professional pilots are 
obtained on a regular basis. 


FINAL THOUGHT 

If Dr. Lee's predictions about the proportion 
of human factor accidents reaching 100% is right, 
then constant awareness of and attention to human 
factor problems by everyone involved with the 
design and operation of aircraft will be the only 
way to prevent aircraft accidents in the future. 
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